PRIVACY POLICY
Privacy Policy
Effective 3 September 2026 · Amended 30 September 2026 (Instagram DMs) · 한국어
Odysseum ("we") operates the Small Wish app and smallwishai.com. This policy explains what we collect, why, and how you can remove it. We comply with Korea's Personal Information Protection Act (PIPA); where the GDPR or CCPA/CPRA applies to you, the rights sections below describe how to exercise those rights.
1. What we collect
| Account | Email address and a sign-in identifier (Firebase Authentication). If you sign in with Google, the email and name Google provides. |
|---|---|
| Closet | Garments you add or import — name, brand, color and size options, the product image or a photo you took, and the product link. |
| Store order import | Only the product cards you select from an order-history page you opened and signed in to yourself inside the app (name, image, options, link). We never read or store the store's passwords, cookies, payment details, or delivery addresses. |
| Photos and screenshots | Images you choose to upload. Order-history screenshots are used only to read the product information and are not stored; garment photos are stored as a downscaled thumbnail in your closet. |
| Recommendations | The outfit suggested each day, the overlap strategy and mood you chose, and a weather summary (temperature, chance of rain). No coordinates are included. |
| Instagram DMs | When you send a reel or post to @smallwish_official, we read that public post's cover image and description to find the clothes (the image is not stored after analysis). Only if you send the app's link code by DM, we keep the sender number Meta issues for our account (not your username) linked to your closet. |
| Automatically collected | Access logs, browser and device type, for service statistics. |
Location is used on your device to look up the weather, and exact coordinates never leave your device. If you turn on the morning nudge, we store an approximate location rounded on your device to about 1km (for example 37.57, 126.98) so we can check that morning's weather. Turning the nudge off deletes it immediately. The server receives only a weather summary. If you decline the location permission, the app falls back to a default city.
If you buy from the online store, we additionally collect the orderer's name, phone number and email, the recipient's name, phone number and address, the depositor name, and the order contents when you submit the order form.
2. Why we use it
- Identify your account and show a closet only you can see
- Analyze garment images and names (type, color, material, style) and recommend outfits for the weather and your taste
- Find the clothes in a reel you send us by Instagram DM and, if you linked your closet, match that outfit to garments you own
- Confirm purchases and payment, and ship goods (store only)
- Respond to support requests; analyze and improve the service
We do not sell or share personal information for cross-context behavioral advertising, and we do not use your data to train third-party models.
3. How long we keep it
Closet items and recommendation history are kept until you delete them or delete your account, and are erased without delay on request. See Delete your account. Records below are retained for the periods required by Korean law:
| Contracts and withdrawal of subscription | 5 years (E-Commerce Act) |
|---|---|
| Payment and supply of goods | 5 years (E-Commerce Act) |
| Consumer complaints or dispute handling | 3 years (E-Commerce Act) |
| Labeling and advertising | 6 months (E-Commerce Act) |
4. Disclosure to third parties
We do not provide your personal information to third parties beyond the purposes in section 2. For store deliveries we provide the recipient's name, phone number and address to the carrier (CJ Logistics), retained until delivery is complete. Lawful requests from investigative authorities are an exception.
5. Processors
| Google Cloud (Firebase, Cloud Run) | Authentication, closet and order storage, server operation |
|---|---|
| Elice ML API / Anthropic | AI analysis of garment images and names (type, color, material, style). Only the image and product name needed for the analysis are sent; no account information. |
| Meta Platforms (Instagram) | Receiving and answering Instagram DMs (Instagram API) |
| Open-Meteo | Weather lookup (called from your device; no account information sent) |
| CJ Logistics | Store shipping |
Our servers are located in the Republic of Korea (Google Cloud, asia-northeast3). If you use the service from outside Korea, your information is transferred to and processed in Korea. Processors above may process data in other regions under their own terms.
6. Your rights
You may request access, correction, deletion, or restriction of processing of your personal information at any time. Contact the privacy officer below in writing, by phone, or by email and we will act without undue delay. Information we are required by law to retain may be excluded from deletion.
If the GDPR applies to you, you also have the right to data portability and to object to processing, and you may lodge a complaint with your local supervisory authority. Our legal bases are performance of a contract (providing the closet and recommendations), consent (camera, photos, location), and legitimate interests (service statistics and security). If the CCPA/CPRA applies to you, you may request disclosure or deletion of the information we hold, and we do not sell or share it as those terms are defined.
7. Destruction
Personal information whose retention period has expired or whose purpose has been achieved is destroyed without delay. Electronic files are deleted irrecoverably; paper documents are shredded or incinerated.
8. Security
We limit access to personal information to the minimum number of people, encrypt data in transit (HTTPS), and keep access records.
9. Children
Small Wish is intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
10. Privacy officer
| Officer | Minjun Kim (CEO, Odysseum) |
|---|---|
| Contact | +82 10-2377-7540 / contact@odysseumai.com |
In Korea you may also report privacy concerns to the Privacy Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office Cybercrime Division (1301), or the National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).
11. Changes
This policy applies from its effective date. If it changes because of a change in law or in the service, we will post a notice at least 7 days before the change takes effect.